Skip to content

Privacy policy

Last updated: October 2026

Overview

Immowache is an invitation-only research workspace for property buyers and investors. The public pages work without an account. The workspace needs a sign-in. Immowache sets no tracking or advertising cookies and runs no analytics script on immowache.com. Its fonts are served from our own server.

The workspace is built from property listings that are published online. Those listings can contain personal data about the people who publish them. This page covers both: the data of visitors and pilot users, and the data that comes from listings.

Data controller

Immowache
Matthew Aberham
411 Walnut St #15148
Green Cove Springs, FL 32043-3443
USA
Operated from the United States
contact@immowache.com

EU representative (Art. 27 GDPR): we have not named one. The exemption in Art. 27(2)(a) GDPR applies: our processing is occasional, does not include special categories of data or data about criminal convictions on a large scale, and is unlikely to result in a risk to your rights and freedoms.

Immowache has the same operator as Rentkompass. See the legal notice.

What data is processed

Visiting the website

Like every website, our server receives your IP address, the address of the page you request, your browser's User-Agent string and other standard HTTP headers with each request. The web server in front of Immowache writes an access log with these details, the time and the response status. The log does not contain the content of your cookies. We use it to run the service and to detect abuse.

The same log is read by fail2ban, a program on our server that blocks IP addresses automatically. An IP address that requests known attack paths (for example /wp-login.php) is blocked for 24 hours, on our server and in Cloudflare's firewall. To block it there, the address is sent to Cloudflare.

Signing in

Sign-in runs through our own sign-in service at access.matthew.systems, which we also use for our other products. Unlike immowache.com, the sign-in service is reached through Cloudflare's network: your browser connects to Cloudflare, and Cloudflare passes the request on to our server (see Cloudflare below). The sign-in service keeps your account: your email address and the way you sign in (for example a password, a passkey, a one-time code sent by email, or a linked Google, GitHub or Apple account, depending on what you use). It also records whether you are invited to Immowache. Sign-in emails are sent through Supabase, which provides the service's login system. The sign-in pages count page views with Umami, a statistics tool we run ourselves on our server; it sets no cookies.

After you sign in, the sign-in service passes Immowache your account ID, your email address and your Immowache access details (role, permissions, whether access is enabled). Immowache puts these into a signed session cookie in your browser. Immowache does not copy them into a database of its own.

Using the workspace

The workspace shows market statistics and listing figures (prices, sizes, yields, district) with a link to the original listing. Immowache does not record which pages or listings you look at, apart from the server access log described above. To protect the statistics interface from abuse, it counts requests per IP address in the server's memory.

Data from property listings

We collect property listings for rent and for sale in Berlin, Munich and Vienna from ImmoScout24 (immobilienscout24.de and immobilienscout24.at). The collected records contain the listing as published: prices, size, rooms, year built, features, address and location, description texts, photo links, and, where the listing shows them, the name, phone number, photo and profile link of the agent or provider.

From these records we calculate the analysis behind the workspace: price and rent figures, comparisons with similar listings, yields and data-quality flags. The analysis keeps the listing title, the street, often the house number, the exact coordinates, the listing link, the link to the first photo, the name of the agency and short passages quoted from the description text that support a flag. Description texts are read by a language model that runs on our own computer, not by an outside AI service. The workspace does not show agents' names or contact details. The agency name appears only in internal admin exports and in statistics per landlord company.

We also keep these records over time. When the same flat is listed again, we can compare the new listing with its earlier ones and estimate prices from a flat's features. If you are named in a listing and do not want your data processed, write to contact@immowache.com.

Email

When you write to contact@immowache.com, for example to ask for pilot access, we receive your email address, your message and anything you include. We use them only to answer you and to handle your request.

Legal basis (GDPR Art. 6)

  • Sign-in and the workspace: Art. 6(1)(b) GDPR. Processing your account and session is needed to give you the pilot access you asked for.
  • Server access log, automatic IP blocking, the Cloudflare proxy for the sign-in service and rate limiting: Art. 6(1)(f) GDPR. Our legitimate interest is running the service reliably and protecting it from abuse.
  • Data from property listings: Art. 6(1)(f) GDPR. Our legitimate interest is market analysis: showing buyers and investors how an asking price compares with the market, and comparing a flat's listings over the years. You can object to this processing at any time (see Your rights).
  • Email: Art. 6(1)(f) GDPR, or Art. 6(1)(b) GDPR when you ask for pilot access. Our legitimate interest is answering your message.

Cookies

Immowache sets no tracking, advertising or analytics cookies. It sets two cookies, both only when you sign in:

  • immowache_login: set when you start signing in. It holds a random check value and the page to return to, protects the sign-in against forgery, and is deleted when the sign-in completes or after 10 minutes at the latest.
  • mk_session: set after a successful sign-in. It holds your account ID, email address and Immowache access details, signed so they cannot be changed. It expires after one hour and is deleted when you sign out.

Both are strictly necessary for the sign-in you request, so they need no consent (§ 25(2) no. 2 TDDDG). The sign-in service at access.matthew.systems sets its own login cookies on its own domain.

Third-party processors

Hosting

Immowache and the sign-in service are hosted by Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany). The hosting provider processes your IP address and request metadata as part of delivering the website. The server is in Germany.

Database

We use Supabase (Supabase, Inc.) as our database. It stores the listing data and the analysis described above, and the accounts of the sign-in service. The database runs in the United States (Amazon Web Services region us-east-1), so this data is stored there. Privacy policy: supabase.com/privacy.

Cloudflare (DNS, and proxy for the sign-in service)

Cloudflare, Inc. runs the name servers for immowache.com: when your browser looks up the address of immowache.com, the lookup is answered by Cloudflare. Requests to immowache.com itself go straight to our server and do not pass through Cloudflare.

The sign-in service at access.matthew.systems is different: it sits behind Cloudflare's proxy. When you sign in, your browser connects to Cloudflare, which forwards the request to our server and the answer back to you. Cloudflare processes your IP address, the request data (the address requested, the headers including the sign-in service's cookies, your browser type, and what you send, such as your email address) and the response. It does this on our behalf, as our processor, to deliver the sign-in pages and to protect them from attacks. Cloudflare also receives the IP addresses that fail2ban blocks (see Visiting the website). Cloudflare can process this data outside the EU, including in the United States.

Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Privacy policy: cloudflare.com/privacypolicy.

Transfers outside the EU

Supabase stores the database in the United States, and Cloudflare can process sign-in traffic there.

The legal basis for these transfers (Art. 13(1)(f) GDPR) is different for each provider. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework, and its certification covers the data it processes for its customers. The European Commission has decided that the Framework protects data adequately (Art. 45 GDPR). Cloudflare's data processing addendum also contains the EU Standard Contractual Clauses for transfers the Framework does not cover. Supabase is not certified under the Data Privacy Framework. For Supabase, the transfers are based on the EU Standard Contractual Clauses in Supabase's data processing addendum (Art. 46(2)(c) GDPR). Both addenda are part of the providers' terms of service. You can read them at cloudflare.com/cloudflare-customer-dpa and supabase.com/legal/dpa.

Data retention

  • Session cookie: one hour. Sign-in cookie: until the sign-in completes, 10 minutes at the latest.
  • Rate-limit counters: in memory for one minute, and lost when the server restarts.
  • Server access log: the log is shared with the other sites on the same server and starts a new file at 10 MB. It keeps the current file and up to five older files; an older file is deleted when a sixth would start, and after 90 days at the latest.
  • Automatic IP blocks: 24 hours.
  • Your account at the sign-in service: until you ask us to delete it, or 24 months after your last sign-in, whichever comes first.
  • Emails: 12 months after the conversation ends, or 12 months after the pilot access it led to ends, whichever is later. We then delete them.
  • Data from property listings: we keep the collected listing records and the analysis without a fixed deletion date, because the history is the purpose: it lets us compare a flat's past listings and estimate prices from features. We keep them as long as they are needed for this historical market analysis, review this at least once a year, and delete them when they are no longer needed for it. You can object to this processing at any time (Art. 21 GDPR) by writing to contact@immowache.com.

Your rights

Under the GDPR you have the right to access, rectify, erase, restrict and port your personal data, and to object to processing based on legitimate interest (Art. 15 to 21 GDPR). If you object to the processing of listing data about you, we stop it unless we have compelling legitimate grounds. To use any of these rights, write to contact@immowache.com.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work.

Changes to this policy

We update this policy when the processing changes. Changes are posted on this page with a new date.

Contact

For privacy questions, write to contact@immowache.com.